<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
<html>
  
<!-- Mirrored from bos.asmhackers.net/docs/filesystems/ntfs/attribute.html by HTTrack Website Copier/3.x [XR&CO'2013], Tue, 07 Oct 2014 11:23:50 GMT -->
<head>
    <title>NTFS Documentation: File Attribute</title>
  </head>

  <body>
      <h1><a href="index-2.html#NTFS" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/index.html#NTFS">NTFS</a> Documentation: File Attribute</h1>

      <h2>Definition</h2>

      A <a href="glossary.html#File" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#File">file</a> property.
      <p>

      <h2>Properties</h2>
      <ul>
	  <li>Each <a href="glossary.html#File" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#File">file</a> attribute is made of:
          <ul>
            <li>An important sequence of bytes called <a name="stream">stream</a> which constitutes the actual value of the attribute.
            <li><a href="glossary.html#Metadata" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#Metadata">Metadata</a> to access the <a href="#stream">stream</a>.
          </ul>
          <p>

	  <li>Each <a href="glossary.html#File" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#File">file</a> attribute in a <a href="glossary.html#File" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#File">file</a> may have a <a name="name">name</a>: in this case, you can access its <a href="#stream">stream</a> using the syntax <code>file_name:attribute_name</code> (that's why you <a href="filename.html#win32_space" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/filename.html#win32_space">can't use the character ':' in file names</a>) through the command line interface.
	  <p>

	  <li><a href="javascript:if(confirm('http://www.microsoft.com/ntserver/  \n\nThis file was not retrieved by Teleport Pro, because it is addressed on a domain or path outside the boundaries set for its Starting Address.  \n\nDo you want to open it from the server?'))window.location='http://www.microsoft.com/ntserver/'" tppabs="http://www.microsoft.com/ntserver/">Windows NT&reg;</a> uses the following pre-defined <a href="glossary.html#File" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#File">file</a> attributes listed in the <a href="AttrDef.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/AttrDef.html">metadata file $AttrDef</a>.
          <p>

	    <a name="available"></a>
            <table border=2 cellspacing=2 cellpadding=2>
	      <tr bgcolor="#E0E0E0">
	        <th><a name="type">Type</a></th>
                <th><a name="label">Label</a></th>
              </tr>
              <tr>
                <th>10</th>
                <th><a href="standard.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/standard.html">$STANDARD_INFORMATION</a></th>
              </tr>
	      <tr>
	        <th>20</th>
	        <th><a href="attrlist.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/attrlist.html">$ATTRIBUTE_LIST</a></th>
	      </tr>
	      <tr>
	        <th>30</th>
	        <th><a href="filename.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/filename.html">$FILE_NAME</a></th>
              </tr>
	      <tr>
	        <th>40</th>
	        <th><a href="volumever.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/volumever.html">$VOLUME_VERSION</a></th>
	      </tr>
	      <tr>
	        <th>50</th>
	        <th><a href="security.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/security.html">$SECURITY_DESCRIPTOR</a></th>
	      </tr>
	      <tr>
	        <th>60</th>
                <th><a href="volumename.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/volumename.html">$VOLUME_NAME</a></th>
	      </tr>
	      <tr>
	        <th>70</th>
	        <th><a href="volumeinf.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/volumeinf.html">$VOLUME_INFORMATION</a></th>
	      </tr>
	      <tr>
	        <th>80</th>
	        <th><a href="data.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/data.html">$DATA</a></th>
	      </tr>
	      <tr>
	        <th>90</th>
	        <th><a href="indexroot.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/indexroot.html">$INDEX_ROOT</a></th>
	      </tr>
	      <tr>
	        <th>A0</th>
	        <th><a href="indexallocation.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/indexallocation.html">$INDEX_ALLOCATION</a></th>
	      </tr>
	      <tr>
	        <th>B0</th>
	        <th><a href="bitmap2.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/bitmap2.html">$BITMAP</a></th>
	      </tr>
	      <tr>
	        <th>C0</th>
	        <th><a href="symlink.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/symlink.html">$SYMBOLIC_LINK</a></th>
	      </tr>
	      <tr>
	        <th>D0</th>
	        <th><a href="HPFSeinf.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/HPFSeinf.html">$EA_INFORMATION</a></th>
	      </tr>
	      <tr>
	        <th>E0</th>
	        <th><a href="HPFSe.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/HPFSe.html">$EA</a></th>
	      </tr>
	    </table>
            <p>

      </ul>

      <h2>Layout</h2>
      Each <a href="glossary.html#File" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#File">file</a> attribute is divided into 2 parts. Although <em>these 2 parts are physically written in a reversed order</em> in the <a href="FILE.html#seqattr" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/FILE.html#seqattr">sequence of attribute part of a FILE record</a>, let me introduce them in this order for a better understanding:
      <ul>
	<li><h3><a name="content_part">The content part</a></h3>
	    Its layout always starts with the <a href="#name">attribute name</a> (N bytes long), but what follows defines the &quot;<a name="residence">residence</a>&quot; property of the <a href="glossary.html#File" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#File">file</a> attribute:
            <p>

            <ul>
              <li>The <a href="glossary.html#File" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#File">file</a> attribute is <a name="resident">resident</a> when the <a href="#stream">stream of the file attribute</a> is stored just after its <a href="#name">name</a>, providing better access times for <a href="glossary.html#File" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#File">file</a> attributes with a small and not likely to grow <a href="#stream">stream</a>.
              <p>

	      <li>When a <a href="glossary.html#File" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#File">file</a> attribute is <a name="non_resident">non-resident</a>, its <a href="#stream">stream</a> is stored in one or more extensions also called <a name="run">run</a>s. A run is a contiguous area of <a href="glossary.html#LCN" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#LCN">LCN</a>s. To reach these runs, <a href="index-2.html#NTFS" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/index.html#NTFS">NTFS</a> stores a table called <a href="runlist.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/runlist.html">runlist</a> just after the <a href="#name">name of the file attribute</a>.
	      <p>

	    </ul>

	<li><h3><a name="header_part">The header part</a></h3>
	    <table border=2 cellspacing=2 cellpadding=2>
	      <tr bgcolor="#E0E0E0">
	        <th>Offset to the beginning of the header part</th>
	        <th>Length</th>
	        <th>Description</th>
              </tr>
	      <tr>
	        <th>0</th>
	        <th>4</th>
	        <th><a href="#type">Type</a></th>
	      </tr>
	      <tr>
	        <th>4</th>
	        <th>4</th>
	        <th><a name="length">Length</a></th>
	      </tr>
	      <tr>
	        <th>8</th>
	        <th>1</th>
	        <th><a name="field_8"><a href="#residence">Non-resident flag</a></a></th>
	      </tr>
	      <tr>
	        <th>9</th>
	        <th>1</th>
	        <th><a name="nl">N=<a href="#name_length">Name length</a></a></th>
	      </tr>
	      <tr>
	        <th>A</th>
	        <th>2</th>
	        <th><a name="ovp">Offset to the <a href="#content_part">content part</a></a></th>
	      </tr>
	      <tr>
	        <th>C</th>
	        <th>2</th>
	        <th><a href="#compressed">Compressed flag</a></th>
	      </tr>
	      <tr>
	        <th><a name="field_E">E</a></th>
	        <th>2</th>
	        <th>Identificator</th>
	      </tr>
	    </table>
	    <p>

	    <dl>
	      <dt><a name="name_length">Name length</a>
                <dd>00 if the <a href="glossary.html#File" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#File">file</a> attribute has no name.
                <p>

	      <dt><a name="compressed">Compressed flag</a>
                <dd>In <a href="index-2.html#NTFS" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/index.html#NTFS">NTFS</a>, data compression is implemented at a <a href="glossary.html#File" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#File">file</a> attribute level, which means that you won't loose a lot of data if a corruption occurs :). It is although only used at a <a href="glossary.html#File" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#File">file</a> level: a compressed <a href="glossary.html#File" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#File">file</a> means that its <a href="data.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/data.html">data attribute</a> is compressed.
                <p>

            </dl>

	    From now on, the layout of the header part depends on the <a href="#residence">residence</a> of the <a href="glossary.html#File" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#File">file</a> attribute:
            <p>

	    <ul>
	      <li>For a <a href="#resident">resident file attribute</a>,
                  <p>

	          <table border=2 cellspacing=2 cellpadding=2>
	            <tr bgcolor="#E0E0E0">
	              <th>Offset to the beginning of the header part</th>
	              <th>Length</th>
	              <th>Description</th>
                    </tr>
		    <tr>
		      <th>10</th>
		      <th>4</th>
	              <th><a name="stream_length">Length of the <b><a href="#stream">stream</a></b></a></th>
		    </tr>
		    <tr>
		      <th>14</th>
		      <th>2</th>
	              <th><a name="osvp">Offset to the <a href="#stream">stream</a></a></th>
		    </tr>
		    <tr>
		      <th>16</th>
		      <th>2</th>
	              <th><a name="field_16"><a href="#indexed">Indexed flag</a></a></th>
		    </tr>
		  </table>
                  <p>

                  <dl>
	            <dt><a name="indexed">Indexed flag</a>
                      <dd>The <a href="glossary.html#File" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#File">file</a> attribute is indexed by an <a href="indexentry.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/indexentry.html">index entry</a>.
	                  <p>
                  </dl>

              <li>For a <a href="#non_resident">non-resident file attribute</a>,
                  <p>

	          <table border=2 cellspacing=2 cellpadding=2>
	            <tr bgcolor="#E0E0E0">
	              <th>Offset to the beginning of the header part</th>
	              <th>Length</th>
	              <th>Description</th>
                    </tr>
		    <tr>
		      <th><a name="field_10">10</a></th>
		      <th>8</th>
	              <th>Starting <a href="#VCN">VCN</a></th>
		    </tr>
		    <tr>
		      <th>18</th>
		      <th>8</th>
	              <th>Last <a href="#VCN">VCN</a></th>
		    </tr>
		    <tr>
		      <th>20</th>
		      <th>2</th>
	              <th><a name="or">Offset to the <a href="runlist.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/runlist.html">runlist</a></a></th>
		    </tr>
		    <tr>
		      <th>22</th>
		      <th>2?</th>
	              <th><a href="#engine">Number of compression engine</a> ?</th>
		    </tr>
		    <tr>
		      <th></th>
		      <th></th>
	              <th></th>
		    </tr>
		    <tr>
		      <th>28</th>
		      <th>8</th>
	              <th><a href="#allocated_size">Allocated size of the <b>stream</b></a></th>
		    </tr>
		    <tr>
		      <th>30</th>
		      <th>8</th>
	              <th><a href="#real_size">Real size of the <b>stream</b></a></th>
		    </tr>
		    <tr>
		      <th>38</th>
		      <th>8</th>
	              <th><a href="#initialized_data_size">Initialized data size of the <b>stream</b></a></th>
		    </tr>
		  </table>
                  <p>

                  <dl>
	            <dt><a name="VCN">VCN</a>
                      <dd>An acronym which stands for Virtual <a href="glossary.html#Cluster" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#Cluster">Cluster</a> Number. The VCN is a notion relative to a <a href="#non_resident">non-resident file attribute</a>. VCNs are ordered from the first <a href="glossary.html#Cluster" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#Cluster">cluster</a> (VCN 0) of the first <a href="#run">run</a> containing the <a href="#stream">stream of the file attribute</a> to the last <a href="glossary.html#Cluster" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#Cluster">cluster</a> of the last <a href="#run">run</a>.
	                  <p>

	                  When the <a href="runlist.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/runlist.html">runlist</a> is very large, the <a href="glossary.html#File" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#File">file</a> attribute can't fit into a single <a href="FILE.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/FILE.html">FILE record</a>. So it is present in several <a href="FILE.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/FILE.html">FILE record</a>s describing the <a href="glossary.html#File" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#File">file</a>, and the <a href="runlist.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/runlist.html">runlist</a> in splitted into several pieces. Both Starting VCN and Last VCN fields are useful to find the good <a href="FILE.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/FILE.html">FILE record</a> pointing to - via the <a href="runlist.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/runlist.html">runlist</a> - the <a href="#run">run</a> containing a given VCN.
	                  <p>

		          <em>Note</em>: If the attribute <b>can</b> fit into a single <a href="FILE.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/FILE.html">FILE record</a>, the Last VCN field (unuseful in this case) can be 00 00 00 00 00 00 00 00.
	              <p>

	            <dt><a name="engine">Number of compression engine</a>
	              <dd>In order to reach the best compression rate, <a href="index-2.html#NTFS" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/index.html#NTFS">NTFS</a> is able to use different compression engines according to the data type to compress. The <a href="engine.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/engine.html">current compression engine</a> uses the value 04.
	              <p>

	            <dt><a name="allocated_size">Allocated size</a> of the <a href="#stream">stream</a>
                      <dd>This is a multiple of the <a href="glossary.html#Cluster" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#Cluster">cluster</a> size that represents the allocated space used to store on the <a href="glossary.html#Volume" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#Volume">volume</a> the <a href="#stream">stream</a> of the <a href="glossary.html#File" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#File">file</a> attribute. If the <a href="#stream">stream</a> is not <a href="#compressed">compressed</a>, it is its <a href="#real_size">real size</a> rounded up to a multiple of the <a href="glossary.html#Cluster" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#Cluster">cluster</a> size. Otherwise, it is smaller.
                      <p>

	            <dt><a name="real_size">Real size</a> of the <a href="#stream">stream</a>
                      <dd>The <a href="#compressed">uncompressed</a> size of the <a href="#stream">stream</a> of the <a href="glossary.html#File" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#File">file</a> attribute.
                      <p>

	            <dt><a name="initialized_data_size">Initialized data size</a> of the <a href="#stream">stream</a>
                      <dd>This is the <a href="#compressed">compressed</a> size (always lower than the <a href="#allocated_size">allocated size</a>) of the <a href="#stream">stream</a> of the <a href="glossary.html#File" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#File">file</a> attribute. If the <a href="#stream">stream</a> is not <a href="#compressed">compressed</a>, it is its <a href="#real_size">real size</a>.
                      <p>

		  </dl>
	    </ul>

        <em>Note</em>:
        <ul>
          <li>A <a href="#resident">resident file attribute</a> is never <a href="#compressed">compressed</a> (and has no &quot;<a href="#engine">number of compression engine</a>&quot; field) because its <a href="#stream">stream</a> is too small.
          <p>

          <li>Information is redundant: <a href="#nl">Name length</a> + <a href="#ovp">Offset to the content part</a> = <a href="#osvp">Offset to the stream</a> (if <a href="#resident">resident</a>) or <a href="#or">Offset to the runlist</a> (if <a href="#non_resident">non-resident</a>).
          <p>

        </ul>
      </ul>

      <h2>Interest</h2>

      You can <a name="creation">create</a> a <a href="glossary.html#File" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#File">file</a> attribute too, but it must have a <a href="#name">name</a>. This feature is not supported in <a href="javascript:if(confirm('http://www.microsoft.com/ntserver/  \n\nThis file was not retrieved by Teleport Pro, because it is addressed on a domain or path outside the boundaries set for its Starting Address.  \n\nDo you want to open it from the server?'))window.location='http://www.microsoft.com/ntserver/'" tppabs="http://www.microsoft.com/ntserver/">Windows NT&reg;</a> 3.51, but <a href="index-2.html#NTFS" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/index.html#NTFS">NTFS</a> allows it.
      <p>

      <h2>Questions</h2>
      As far Helen is concerned, although the resource sharing is made at a <a href="glossary.html#File" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#File">file</a> level and not at a <a href="glossary.html#File" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#File">file</a> attribute level, each <a href="glossary.html#File" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#File">file</a> attribute also owns a lock allowing to lock an area of bytes, to manage the access concurrency. Where is this information stored?
      <p>

      <hr>
      <address><a href="mailto:regis@via.ecp.fr">Regis Duchesne</a> at <a href="javascript:if(confirm('http://www.via.ecp.fr/  \n\nThis file was not retrieved by Teleport Pro, because it is addressed on a domain or path outside the boundaries set for its Starting Address.  \n\nDo you want to open it from the server?'))window.location='http://www.via.ecp.fr/'" tppabs="http://www.via.ecp.fr/">VIA</a>, <a href="javascript:if(confirm('http://www.ecp.fr/  \n\nThis file was not retrieved by Teleport Pro, because it is addressed on a domain or path outside the boundaries set for its Starting Address.  \n\nDo you want to open it from the server?'))window.location='http://www.ecp.fr/'" tppabs="http://www.ecp.fr/">ECP</a>, France</address>
<!-- Created: Mon Dec  9 09:37:49 MET 1996 -->
<!-- hhmts start -->
Last modified: Mon Feb 15 09:02:01 PST 1999
<!-- hhmts end -->
  </body>

<!-- Mirrored from bos.asmhackers.net/docs/filesystems/ntfs/attribute.html by HTTrack Website Copier/3.x [XR&CO'2013], Tue, 07 Oct 2014 11:23:58 GMT -->
</html>
